CWE-552 · Files or Directories Accessible to External Parties (page 6)
Page 6 of 6 — CVEs classified under CWE-552, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-12079 | High | 7.5 | 2017-12-04 | Files or directories accessible to external parties vulnerability in picasa.php in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote a… |
CVE-2017-16651 | High | 7.8 | 2017-11-09 | Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including c… |
CVE-2017-7079 | Medium | 5.5 | 2017-10-23 | An issue was discovered in certain Apple products. iTunes before 12.7 is affected. The issue involves the "Data Sync" component. It allows attackers to access… |
CVE-2017-11829 | Medium | 5.5 | 2017-10-13 | Microsoft Windows 10 allows an elevation of privilege vulnerability when the Windows Update Delivery Optimization does not properly enforce file share permissi… |
CVE-2017-14942 | Critical | 9.8 | 2017-09-30 | Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct request for cgi-bin/Downl… |
CVE-2017-2551 | High | 7.5 | 2017-09-28 | Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download. |
CVE-2017-10930 | Critical | 9.8 | 2017-09-19 | The ZXR10 1800-2S before v3.00.40 incorrectly restricts access to a resource from an unauthorized actor, resulting in ordinary users being able to download con… |
CVE-2017-6774 | Medium | 5.0 | 2017-08-17 | A vulnerability in Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, remote attacker to… |
CVE-2017-7737 | Medium | 4.9 | 2017-08-10 | An information disclosure vulnerability in Fortinet FortiWeb 5.8.2 and below versions allows logged-in admin user to view SNMPv3 user password in cleartext in… |
CVE-2017-11746 | High | 7.5 | 2017-07-30 | Tenshi 0.15 creates a tenshi.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging… |
CVE-2017-1308 | Medium | 6.5 | 2017-07-13 | IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0 could allow an authenticated attacker to download files they should not have access to due t… |
CVE-2015-5211 | Critical | 9.6 | 2017-05-25 | Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Do… |
CVE-2016-3715 | Medium | 5.5 | 2016-05-05 | The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. |
CVE-2015-1350 | Medium | 5.5 | 2016-05-02 | The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege att… |
CVE-2009-3597 | | 2009-10-08 | Digitaldesign CMS 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database… | |
CVE-2005-1835 | | 2005-06-01 | NEXTWEB (i)Site stores databases under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information vi… |